REMARKS 



Please enter the amendments set forth above prior to examination of the present 
application. Independent claims 1, 10, and 17 have been amended to further particularly point 
out and distinctly claim the subject matter regarded as the invention. No new matter had been 
added. Applicant respectfully submits the following remarks in response to the Advisory Action 
mailed on July 1, 2008. 

The Final Office Action rejected claims 1-15 and 17-22 under 35 U.S.C. 103(a) as being 
unpatentable over Hypponen (2003/0191957) further in view of Liang (2003/0208687). It is 
respectfully submitted that claims 1-15 and 17-22, as currently amended, are not made obvious 
by the cited references. 

Claim 1 , as amended, recites a network virus monitor comprising a virus sensor where 
"the bandwidth of the network is substantially unaffected in a first mode in that data packets 
continue to their destination after they are copied creating copied data packets which are 
analyzed for the computer virus." As described in the specification, the network virus monitor is 
capable of operating in a number of modes. One mode, as described in paragraphs [0041] and 
[0042] of the specification, is a stand-by mode. The stand-by mode allows all packets to 
continue to flow in network 100 after the packet has been copied. This allows the network 
bandwidth to be preserved by the fact that virus monitor 102 monitors the network traffic by 
copying all of the data packets and using the copied data for its analysis. If a virus is detected by 
the virus monitor, an event flag is generated and the threat is corrected. 

In contrast, Hypponen discloses intercepting, identifying, and transferring data to a virus 
scanner in paragraphs [0014] - [0019]. In certain embodiments, data intercepted at a transit node 
is stored in a memory of that node, while a copy of the data is transferred to the virus scanning 
server for virus scanning. If the virus scan identifies no viruses in the data, the server need only 
return an OK message to the transit node. The purpose of this is to minimize the data transfer 
between the virus scanning server and the transit node. It is respectfully submitted that 
Hypponen does not teach nor suggest a mode where data packets are allowed to continue to their 
destination after being copied as recited in the claimed invention. Instead, Hypponen discloses 
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storing data packets in the memory of a node and only passing the data through after an "OK" 
message has been received from the virus monitor. 

Even if Liang were combined with Hypponen, the combination still does not suggest or 
make obvious a mode in which data packets continue to their destination after they are copied as 
recited in the amended claims. The four modes disclosed in Liang (continuous service mode, an 
idle mode, a maintenance mode, and a service-maintenance mode) do not recite the same 
limitations as the claimed first mode. 

Furthermore, amended claim 1 also recites a virus monitor that is able to " automatically 
collect network environment data and assign an IP address to itself , and wherein the virus 
monitor automatically locates a controller in the network and registers itself with the controller , 
from where the virus monitor receives a rule set and an outbreak prevention policy (OPP)." As 
described in paragraphs [0030] and [0031] of the specification, these steps are automatically 
performed during an initialization phase of the virus monitor. It is respectfully submitted that 
neither Hypponen nor Liang teach or suggest an initialization phase that is automatically 
performed which assigns an IP address to the virus monitor and registers the virus monitor with a 
controller. For at least these reasons, it is respectfully submitted that claim 1 of the present 
invention is not made obvious by a combination of the disclosures in Hypponen and Liang 

Independent claims 10 and 17, as amended, also contain the same limitations as discussed 
above. For at least the same reasons, it is respectfully submitted that these claims are also not 
made obvious by Hypponen and Liang. 

Dependent claims 2-9, 11-15, and 18-22 are dependent on independent claims 1, 10, and 
17, respectively. These dependent claims recite additional limitations that further distinguish 
them from the cited references and therefore, are not made obvious by the cited references. 
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CONCLUSION 



Applicant believes that all pending claims are allowable and respectfully request a Notice 
of Allowance for this application from the Examiner. Should the Examiner believe that a 
telephone conference would expedite the prosecution of this application, the undersigned can be 
reached at telephone number (408) 255-8001. 



Respectfully submitted, 
BEYER LAW GROUP LLP 



/Steven Chang/ 
Steven Chang 
Registration No. 59,424 

P.O. Box 1687 

Cupertino, CA 95015-1687 

(408) 255-8001 
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